HIGH Introduced in 2.6.30
cx23885 NetUpCI UAF
CVE-2026-89893
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool.
02KernelScan AI Analysis
Risk summary
A use-after-free in the cx23885 DVB driver allows a pending workqueue item to dereference a freed state structure during device teardown. Exploitation requires specific NetUP Dual DVB-S2 CI PCIe hardware and either physical access to remove the card or root privileges to unbind the device. The race condition can lead to kernel memory corruption, potentially resulting in a crash or arbitrary read/write if the timing window is won.
Vulnerability analysis
During removal of the NetUP Common Interface driver, cleanup code frees memory that a pending background task may still reference. The task is scheduled by hardware interrupts when card status changes, and while teardown disables those interrupts, it does not wait for tasks already queued. This lets the task run after the memory is freed, causing a use-after-free. The fix waits for the pending task to finish before releasing the device and freeing the memory. Only systems with the specific NetUP Dual DVB-S2 CI PCIe card are affected, and an attacker needs either physical access to remove the card or root privileges to unbind the driver.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.30 | 5.10.270 | aaf76794b870 |
| 5.15 | 2.6.30 | 5.15.221 | f7ff5adb63c1 |
| 6.1 | 2.6.30 | 6.1.188 | 140ecbcbf978 |
| 6.12 | 2.6.30 | 6.12.110 | 5deec890ecfa |
| 6.18 | 2.6.30 | 6.18.51 | bf3f49273d5b |
| 6.6 | 2.6.30 | 6.6.157 | ec82b0cf7f75 |
| 7.2 | 2.6.30 | 7.2.5 | 99cd62b9b1c8 |
| mainline | 2.6.30 | 7.3 | 4e143d662ca9 |
| cip/5.10 | 2.6.30 | 5.10.271-cip78 | aaf76794b870 |
| cip/6.1 | 2.6.30 | 6.1.189-cip61 | 140ecbcbf978 |
| cip/6.1-rt | 2.6.30 | 6.1.189-cip61-rt32 | 140ecbcbf978 |
| cip/6.12 | 2.6.30 | 6.12.111-cip32 | 5deec890ecfa |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |